Marshmallow: Nested excludes get overwritten

[timc13]

It seems whenever an parent level exclude is specified with dot notation, the child field level excludes are overwritten. It would be great if they could be concatenated.

Here's an example:

from marshmallow import fields, Schema

class FooChildSchema(Schema):
    boo = fields.String()
    far = fields.String()
    faz = fields.String()

class FooSchema(Schema):
    foo = fields.String()
    bar = fields.String()
    baz = fields.String()
    child = fields.Nested(FooChildSchema, exclude=('boo',))

obj = {
    'foo': 'foo',
    'bar': 'bar',
    'baz': 'baz',
    'child': {
        'boo': 'boo',
        'far': 'far',
        'faz': 'faz',
    },
}

serialized = FooSchema(exclude=('foo', 'child.faz')).dump(obj).data
print(serialized)

I expect :

{'child': {'far': 'far'}, 'baz': 'baz', 'bar': 'bar'}

instead, I get:

{'child': {'far': 'far', 'boo': 'boo'}, 'baz': 'baz', 'bar': 'bar'}

[timc13]

is this expected behavior? Do we want nesting to include parent excludes ?

[timc13]

@sloria any thoughts on this?

[lafrech]

I also think the child schema should exclude the union of the two exclude parameters. In fact, it should include only the intersection of the only parameters minus the union of the exclude.

Would you like to propose a PR for this?

[deckar01]

I will start writing some tests for this issue and see if there are any edge cases that need more discussion. I implemented the offending feature in #468, and it turned out a little more complex than I expected.

[deckar01]

I ran into a funky edge case that has security implications. I reported the underlying issue as #772.

class ChildSchema(Schema):
    foo = fields.Field()
    bar = fields.Field()

class ParentSchema(Schema):
    baz = fields.Nested(ChildSchema, only=('bar',))

schema = ParentSchema(only=('baz.foo',))

The result of the intersections of these only options is an empty set, which we treat as disabling the only filter...

This change to only would make it possible to get unfiltered data without explicitly supplying any falsy values to only, so I think #772 needs to be fixed first.

[deckar01]

Here is a working fix for this issue: https://github.com/marshmallow-code/marshmallow/compare/2.x-line...deckar01:728-only-exclude-inheritance-fix

It has a failing test due to #772.

[deckar01]

I will pick this back up now that #772 is fixed. Thanks @lafrech.

[timc13]

@deckar01 don't mean to be annoying - but hopefully you havent forgotten about this? :)